CVE-2019-3681

osc: stores downloaded (supposed) RPM in network-controlled filesystem paths

CRITICAL

9.8

CVSS Score

Published: June 29, 2020 at 12:00 PM UTC

Updated: June 17, 2026 at 02:35 AM UTC

6 products affected across 2 vendorsOscLinux Enterprise ServerLeap

Using SUSE Linux Enterprise Module for Development Tools 15 by SUSE?

Get instant alerts when new vulnerabilities affect SUSE Linux Enterprise Module for Development Tools 15 - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

CRITICAL9.8

Exploit prediction

EPSS 1%

Description

A External Control of File Name or Path vulnerability in osc of SUSE Linux Enterprise Module for Development Tools 15, SUSE Linux Enterprise Software Development Kit 12-SP5, SUSE Linux Enterprise Software Development Kit 12-SP4; openSUSE Leap 15.1, openSUSE Factory allowed remote attackers that can change downloaded packages to overwrite arbitrary files. This issue affects: SUSE Linux Enterprise Module for Development Tools 15 osc versions prior to 0.169.1-3.20.1. SUSE Linux Enterprise Software Development Kit 12-SP5 osc versions prior to 0.162.1-15.9.1. SUSE Linux Enterprise Software Development Kit 12-SP4 osc versions prior to 0.162.1-15.9.1. openSUSE Leap 15.1 osc versions prior to 0.169.1-lp151.2.15.1. openSUSE Factory osc versions prior to 0.169.0 .

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Osc · openSUSE

95%

v < 0.162.1-15.9.1v < 0.169.0v < 0.169.1-3.20.1v < 0.169.1-lp151.2.15.1

Affected range stops below 0.162.1-15.9.1, so it looks safe — our inference, not a vendor statement

Affected range stops below 0.169.0, so it looks safe — our inference, not a vendor statement

Affected range stops below 0.169.1-3.20.1, so it looks safe — our inference, not a vendor statement

Affected range stops below 0.169.1-lp151.2.15.1, so it looks safe — our inference, not a vendor statement

opensuse-factory (environment) · opensuse-leap (environment) · suse-linux-enterprise-server (environment) · suse-linux-enterprise-software-development-kit (environment)

Factory · openSUSE

60%

osc ≤ v < 0.169.0osc

Affected range stops below 0.169.0, so it looks safe — our inference, not a vendor statement

Leap · openSUSEdrupal

60%

osc ≤ v < 0.169.1-lp151.2.15.1osc

Affected range stops below 0.169.1-lp151.2.15.1, so it looks safe — our inference, not a vendor statement

Development Tools Module · SUSE

60%

osc ≤ v < 0.169.1-3.20.1osc

Affected range stops below 0.169.1-3.20.1, so it looks safe — our inference, not a vendor statement